Rewterz Threat Alert – Multiple Jenkins Plugins Vulnerabilities
January 25, 2024Rewterz Threat Alert –APT Group Gamaredon aka Shuckworm – Active IOCs
January 29, 2024Rewterz Threat Alert – Multiple Jenkins Plugins Vulnerabilities
January 25, 2024Rewterz Threat Alert –APT Group Gamaredon aka Shuckworm – Active IOCs
January 29, 2024Severity
Medium
Analysis Summary
Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also acquired its payloads from Microsoft OneDrive and an attacker-controlled website.
GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts. GuLoader malware spawns AgentTesla In its latest campaign in October 2022. AgentTesla is renowned for stealing data from a variety of target workstations’ apps, including browsers, FTP clients, and file downloaders.
Guloader is often distributed as part of a wider malware campaign and is usually delivered in a packed or encrypted form to evade detection by security software. Once it has successfully installed itself on a system, it will attempt to establish persistence by modifying system settings, creating registry entries, and adding itself to startup items.
GuLoader has been actively deployed for over three years, and its developers continue to enhance its capabilities. The latest version incorporates advanced anti-analysis techniques, making it extremely challenging for security researchers to analyze and detect. The most recent GuLoader samples consistently receive zero detections on popular antivirus platforms like VirusTotal, ensuring the stealthy execution of its malicious payloads.
One notable feature of GuLoader is its fully encrypted payload, which includes the PE headers. This enables threat actors to store the payloads on well-known public cloud services, effectively evading traditional antivirus protections. By leveraging cloud storage, the malicious payloads can remain available for download over an extended period without raising suspicion.
While earlier versions of GuLoader were implemented as Visual Basic 6 (VB6) applications containing encrypted shellcode, the current variants predominantly utilize VBScript and NSIS installer-based techniques. The VBScript variant, in particular, stores the shellcode on a remote server, further complicating detection and analysis.
To protect against Guloader malware, it is important to have a strong antivirus solution in place and to keep all software up to date with the latest security patches. Additionally, users should be cautious when opening email attachments or clicking on links from unknown or suspicious sources.
Impact
- Information Theft
Indicators of Compromise
MD5
- a6fc2d8611cae0eda7fc1b53495a6b3b
- 2afbe86c3d12f195ba33d271bf5a8a42
- 8d7167b663a07bdb1a05a47289712ecd
- 2f1eadf99c8fe2094f5ff780bad3b73c
- 85c817d32414edbada0e6b79597ccb5b
SHA-256
- 7361df98c7cd1e56e0345e61cf68c1d5818d4064269f9b234511c7060e97ad9f
- 6debfb726a4c59128ebcb3b5e17a62c67e378d60e93c17491e420475b435d418
- f3ed72f4d4bd6a15e39b80e78ccc098cd17deac213ab77f7a92dbf3b9e15c652
- 00f2bbe32209b886785073d361b168a81e689a71520660dc8e54201c54272813
- 73c7d4560328c3acf7dc311c0d1459cbe271bca0b70ea9e34e434d073e593368
SHA-1
- 0a8a58bc8bfa8eeb98dca98af8b55aa780f52b10
- 85a931ee8d32eb1b2781bd604d3f87e32900f3ca
- b0f857cbdd33560ae446a942257b34885f735677
- 34490abfbb1cbc9e8adebed82d65661d644cade9
- 775e1a46748fa824795908f934cc2253ab94b769
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.